Automated cryptographic analysis, runtime tracing, and SSL pinning bypass for Android applications. Local-first security research toolkit powered by Claude.
npm i -g morrigan// hooked javax.crypto.Cipher.doFinal → input b"5c 8a 91 ff 02 18 …" → output b"3a 7e 9c 22 4d a1 …" // 12 vectors collected → python crypto.py → validate vs runtime PASS · 12/12
Static search finds the candidate routines. Runtime tracing collects inputs and outputs. The agent writes a Python replica and validates it byte-for-byte before it lands on disk.
// proposed plan, 4 steps 1. apktool d target.apk 2. jadx-cli — sources/ 3. frida -U -f com.target.app 4. collect → crypto.py → approve · edit · cancel
Nothing executes on your device, your APK, or your filesystem without your sign-off. Plans are inspectable, editable, and rerunnable from the workspace.
// vendor heartbeat — 9 fields license_id hashed account_id anonymous product_version 1.0.x hw_fingerprint hashed activation_ts … last_check_ts … build_id … os_type windows 11 license_status active
APKs, decompiled code, Frida logs, generated scripts, project names, endpoints, LLM prompts — none of it touches the vendor. Local-first. BYOK Anthropic.
~/.morrigan/projects/com.target/ ├── apk/ target.apk + splits ├── decompiled/ jadx + apktool out ├── hooks/ 12 frida scripts ├── traces/ 128 captures ├── crypto.py validated module ├── plan.md └── session.md markdown report
No hidden state inside the agent. Generated Frida scripts and Python modules are inspectable, version-controllable, and reusable across projects.
Bundled apktool + JADX, driven by the agent. Static search for crypto usage, network-stack indicators, and basic protection markers.
Bundled hook template library + dynamic generation. Spawn or attach. Crash recovery built in. Captures fed straight to the replication pipeline.
The crown jewel. Inputs and outputs collected at runtime become test vectors; the generated Python is validated byte-for-byte before it ships.
Generated hooks for the common pin-check patterns. For authorized testing only. Inspectable, editable, in your workspace.
Workspace artifacts persist across sessions. Markdown reports summarise what the agent did, what worked, and what it parked for review.
Every active step is proposed first. The agent waits. You read, edit, approve. Then execution. This is the difference between automation and autonomy.